What’s Vulnerable › Vulnerabilities
CVE-2020-11619: jackson-databind mishandles the interaction between serialization gadgets and typing
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-04-07 · updated 2026-10-08
- Weakness: CWE-502
Description
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Affected products
- Debian Linux: 8.0
- FasterXML jackson-databind: from 2.0.0 before 2.9.10.4 — fixed in 2.9.10.4
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
- NetApp Steelstore Cloud Integrated Storage: all versions
- Oracle Corporation Oracle Agile PLM: 9.3.6
- Oracle Banking Platform: from 2.4.0 through 2.9.0
- Oracle Communications Calendar Server: 8.0.0.4.0
- Oracle Communications Contacts Server: 8.0.0.4.0, 8.0.0.5.0
- Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0 through 8.2.2
- Oracle Communications Evolved Communications Application Server: 7.1
- Oracle Communications Instant Messaging Server: 10.0.1.4.0
- Oracle Communications Network Charging And Control: from 12.0.0 through 12.0.3; 6.0.1
- Oracle Corporation Enterprise Manager Base Platform: 13.3.0.0, 13.4.0.0
- Oracle Global Lifecycle Management Opatch: before 12.2.0.1.20 — fixed in 12.2.0.1.20
- Oracle Corporation JD Edwards EnterpriseOne Orchestrator: before 9.2.4.2 — fixed in 9.2.4.2
- Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.4.2 — fixed in 9.2.4.2
- Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8, 19.12
- Oracle Corporation Retail Merchandising System: 15.0
- Oracle Retail Sales Audit: 14.1
- Oracle Corporation Retail Xstore Point of Service: 15.0, 16.0, 17.0, 18.0, 19.0
- Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0
- Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.9.0 before 2.9.10.4; 2.9.0, 2.9.0.pr1, 2.9.0.pr2, 2.9.0.pr3, 2.9.0.pr4, 2.9.1 (+15) — fixed in 2.9.10.4
How to fix
Upgrade to a fixed version: FasterXML jackson-databind 2.9.10.4; Oracle Global Lifecycle Management Opatch 12.2.0.1.20; Oracle Corporation JD Edwards EnterpriseOne Orchestrator 9.2.4.2; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.4.2; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.9.10.4. Check the vendor advisory for mitigations.
References
- https://github.com/FasterXML/jackson-databind/issues/2680
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
- https://security.netapp.com/advisory/ntap-20200511-0004/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/FasterXML/jackson-databind/issues/2680
- https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html
- https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
Get alerted when CVE-2020-11619 or the next vulnerability affects your stack